Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New patches allow building Linux IPv6-only

phoronix.com

Post reply on HN
Print view View original

111–120 of 198 posts

Re: New patches allow building Linux IPv6-only

#111

Post by iso1631 »

wredcoll wrote: post #84
everdrive wrote: post #33

Earlier quoted context omitted.

I'm not confused about the NAT / firewall distinction, but it might be nice if my ISP didn't have a constant, precise idea of exactly how many connected devices I owned. Can that be _inferred_ with IPv4? Yes, but it's fuzzier.

Aren't your home addresses assigned by your local router?

the ISP can see 58 different ipv6 addresses sending packets in the last hour

With ipv4 it can see one ipv4 address

Now sure that 58 could all be on one device with 58 different IPs and using a different one for each connection

In reality that's not the case.

Re: New patches allow building Linux IPv6-only

#112

Post by zekica »

craftkiller wrote: post #88
jrm4 wrote: post #77

Earlier quoted context omitted.

[flagged]

Temporary addresses are enabled by default in OSX, windows, android, and iOS. That's what, like 95% of the consumer non-server market? As for Linux, that's going to be up to each distro to decide what their defaults are. It looks like they are _not_ the default on FreeBSD, which makes sense because that OS is primarily targeting servers (even though I use it on my laptop).

Temporary addresses are used by any Linux distro using NetworkManager (all desktop ones). For server distros, it can differ.

Re: New patches allow building Linux IPv6-only

#113

Post by zekica »

ErroneousBosh wrote: post #83
Sanzig wrote: post #37

Earlier quoted context omitted.

Why don't you want every device to have a public IP? There seems to be a perception that this is somehow insecure, but the default configuration of any router is to firewall everything. And one small bonus of the huge size of a /64 is that port scanning is not feasible, unlike in the old days when you could trivially scan a whole IPv4 /24 of a company that forgot to configure their firewall. NAT may work fine for you…

> Why don't you want every device to have a public IP? What would be the advantage in it?

Trivially easy do direct connections between devices (if desired), no issues when creating VPNs between networks using private ranges.

What would be the disadvantage?

Re: New patches allow building Linux IPv6-only

#114

Post by IshKebab »

vel0city wrote: post #97
Incipient wrote: post #59

The main thing I don't like is type-ability. Even now I type in 192.168.1.14 to connect to my mates computer to play satisfactory. No way in heck am I trying in an ip6!

Why not just type in "mates-pc" and have functional mDNS and not have to memorize a bunch of numbers? Why not just expect your OS's DNS setup to actually just work?

Because mDNS usually doesn't work and just expecting it to work doesn't change that?

Re: New patches allow building Linux IPv6-only

#115

Post by zekica »

qalmakka wrote: post #35
everdrive wrote: post #12

Earlier quoted context omitted.

- I don't want my interfaces to have multiple IP addresses - I don't want my devices to have public, discoverable IPs - I like NAT and it works fine - I don't want to use dynamic DNS just so I have set up a single home server without my ISP rotating my /64 for no reason (and no SLAAC is not an answer because I don't want multiple addresses per interface) - I don't need an entire /48 for my home network IPv6 won't hel…

NAT is arguably a very broken solution.IPv4 isn't meant to be doing address translation, period. NAT creates all sorts of issues because in the end you're still pretending all communications are end to end, just with a proxy. We had to invent STUN and all sorts of hole punching techniques just to make things work decently, but they are lacking and have lots of issues we can't fix without changing IPv4. I do see why s…

And the worst part about CGNAT is that you have two bad solutions:

Either EIM/EIF (preferably with hairpinning) where you can practically do direct connections but you have to limit users to a really low number of "connections" breaking power users.

Or EDM/EDF where users have a higher number of "connections" but it's completely impossible to do direct connections (at least not in any video/voice calling system).

Re: New patches allow building Linux IPv6-only

#116

Post by iso1631 »

knorker wrote: post #56

I would like this option, to make it easier to run a CI environment truly IPv6-only. As in socket() to create a v4 socket should fail. seccomp could only do this partially, in that there are other avenues (e.g. io_uring), and I want it to be the case throughout the boot process.

Creating a v4 socket should map to a v6 address lower down, making v6 transparent to v4 only applications.

Re: New patches allow building Linux IPv6-only

#117

Post by zekica »

iso1631 wrote: post #110
knorker wrote: post #38

Earlier quoted context omitted.

So run fc00::/7 addresses with IPv6 NAT. That addresses all of your concerns, and you have that option.

Sure you can do that So what's the point in ipv6?

You can do fc00::/7 in addition to public addresses so your lights don't have public address while your phone does.

Re: New patches allow building Linux IPv6-only

#118

Post by iamnothere »

iso1631 wrote: post #109
iamnothere wrote: post #104

Earlier quoted context omitted.

Not every device can run its own firewall. IoT devices, NVR systems, etc should be cordoned off from the internet but typically cannot run their own firewall.

Sure, but they sit on an iot vlan where your firewall prevents access except specificly allowed services

You must have not read my original post. I said that the NAT provides an additional fallback layer of safety in case you accidentally misconfigure your firewall. (This has happened to me once before while working late and I’ve also seen it in the field.)

Re: New patches allow building Linux IPv6-only

#119

Post by fasterik »

gertop wrote: post #89
patmorgan23 wrote: post #73

Earlier quoted context omitted.

Hmmmm maybe someone should come up with a SYSTEM to organize NAMES for ips, maybe using hierarchical DOMAINs.... Oh wait.

Your bad attempt at humor makes it quite clear that you've never dealt with network engineering or administrating to any extent. Admitting that ipv6 has some downsides, however minor they may seem to you, won't hurt your quest to render ipv4 obsolete. In fact being less insufferable is how you win people to your causes, not by laughing at their genuine albeit minor issues.

They were making a legitimate point a humorous way. The problem of manually typing in IP addresses has been solved by DNS for over 50 years.

Re: New patches allow building Linux IPv6-only

#120

Post by matthews3 »

patmorgan23 wrote: post #73
Incipient wrote: post #59

The main thing I don't like is type-ability. Even now I type in 192.168.1.14 to connect to my mates computer to play satisfactory. No way in heck am I trying in an ip6!

Hmmmm maybe someone should come up with a SYSTEM to organize NAMES for ips, maybe using hierarchical DOMAINs.... Oh wait.

We could abbreviate that to SND!
Post reply on HN